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DETAILED ACTION 

Response to Amendment 

1 . A request for continued examination under 37 CFR 1.114, including the fee set 
forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this 
application is eligible for continued examination under 37 CFR 1.114, and the fee set 
forth in 37 CFR 1 .17(e) has been timely paid, the finality of the previous Office action 
has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 
04/14/2008 has been entered. 

2. Claims 1-16 are pending in the application. Claim 16 canceled. 

Claim Rejections - 35 USC § 103 

3. The following is a quotation of 35 U.S.C. 1 03(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as 
set forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the invention 
was made to a person having ordinary skill in the art to which said subject matter pertains. Patentability 
shall not be negatived by the manner in which the invention was made. 



4. Claims 1-7, 9-13, 15 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Veres et al. [US Pat: 6,807,156] in view of Riddle et al. [US Pat: 6,591,299]. 
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Regarding claim 1 , Veres et al in the invention of "Scalable Real-Time Quality of 
Service Monitoring and Analysis of Service Dependent Subscriber Satisfaction in IP 
Networks" disclosed a traffic measurement system (Figs 3-4) comprising: a plurality of 
measurement devices (probes or processes monitoring traffic at points A & B of 
Fig 3) that collect packets flowing through Internet links between routers (monitors A & 
B monitoring links between routers, Fig 3, col 8, lines 51-65), extract (capture) 
traffic data required to analyze traffic from the collected packets (item 120 of Fig 4), 
and process the extracted data into predetermined flow types (microflows, col 8,lines 
66-67,col 9, lines 1-5); and an analysis server that identifies applications (subscriber 
identification and applications) of traffic by analyzing the traffic data transferred from 
the plurality of measurement devices as a whole (col 9, lines 6-10), classifies the 
identified applications into predetermined traffic types, and outputs the classification 
result (col 9, lines 10-12), but fails to disclose analyzing the traffic data includes 
analyzing payload data included in the traffic data and the traffic types including a traffic 
type that is identified based on an application signature from other flows since the port 
numbers are exchanged through other control flows. However, Riddle et al in the 
invention of "Method for Automatically Classifying Traffic with Enhanced Hierarchy in a 
Packet Communications Network" disclosed a method for examining the data contained 
in a traffic flow for classifying the packets based on an application signature of the 
packet flow exchanged over several application ports (examine the packet header to 
classify the traffic distinguished by a signature in the packet flow exchanged over 
known and dynamic ports, col 12, lines 45-67, col 13, lines 1-67, Figs 3,4A/B). 
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Therefore it would have been obvious for one of ordinary skill in the art at the time the 
invention was made to use the method of examining the data contained in a traffic flow 
for classifying the packets based on an application signature of the packet flow 
exchanged over application ports as taught by Riddle et al in the system of Veres et al 
to analyze every part of the traffic data packet to accurately classify the packets in to 
predetermined application type that are exchanged through the flows. One is motivated 
as such in order to accurately classify the packets by analyzing the payload data 
included in the traffic data to minimize the drop rate of the packets to enhance the 
quality of service. 

Regarding claim 2, Veres et al disclosed that a plurality of time receiving devices 
that extract time signals from a GPS satellite or a CDMA base station to synchronize the 
times of the plurality of measurement devices (col 2, lines 50-53). 

Regarding claim 3, Veres et al disclosed each of the plurality of measurement 
devices comprises: a packet collection unit that collects the packets flowing through the 
Internet lines from router connection lines and records the collection times of the 
packets (packet filtering process, item 120 of Fig 4, col 8, lines 66-67, col 9, lines 
1-5); a flow generation unit (item 140 of Fig 4) that generates flows using the packets 
having the same data (microflow processor, item 130 of Fig 4), including a target 
address, a protocol, and a port number (col 6, lines 21-26), from the packets collected 
by the packet collection unit (captured packets stored in shared memory for flow 
identification, col 9, lines 6-13), extracts data required for detailed analysis of the 
applications after analyzing the contents of the packets (col 6, lines 20), and stores the 
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extracted data according to the flow (database of monitored microflows); and a 

transfer unit that transfers the data stored in the flow generation unit to the analysis 
server according to a predetermined time interval (col 9, lines 14-45). 

Regarding claims 4-5, Veres et al disclosed that the packet collection unit 
collects the packets by using one of tapping (probing or sniffing), port mirroring 
(application dependent port, FTP, HTTP, TCP, col 3, lines 18-33) and signal 
distribution and the data required for detailed analysis of the applications are application 
signatures (service dependent applications, RTP, FTP, WWW etc.,) for identifying 
the applications in payload of the packets (col 4, lines 44-61). 

Regarding claim 6, Veres et al disclosed wherein the analysis server (microflow 
processor, item 130 of Fig 4) comprises: a data receiving unit (network interface and 
shared memory, item 110 of Fig 4, col 9, lines 14-29) that receives the packet data 
from the plurality of measurement devices (probes or processes monitoring traffic at 
points A & B of Fig 3); a traffic analysis unit (prefiltering processor, item 120 of Fig 
4) that analyzes the data provided from the plurality of measurement devices via the 
data receiving unit as a whole (col 9, lines 30-45), and classifies the applications into 
the traffic types (WWW, FTP, Streaming Media, VoIP application dependent 
module, item 140 of Fig 4, col 9, lines 5-13) according to the analysis result; a data 
storing unit (database of monitored subscribers/microflows, Fig 4) that stores the 
traffic analysis result (delay, throughput, efficiency, packet loss etc.,) of the traffic 
analysis unit; and a user interface that displays the traffic analysis result stored in the 
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data storing unit to a user after processing the traffic analysis result into various types 
desired by the user (user reports, col 4, lines 44-67). 

Regarding claim 7, Veres et al disclosed that the analysis server further 
comprises a report output unit (report, item 140 of Fig 4) that processes the traffic 
analysis result from the traffic analysis unit into a predetermined report type (col 5, 
lines 31-67) and stores the processed data in the data storing unit (database of 
monitored subscribers/microflows, Fig 4), and the report is displayed (microflow 
record) to the user through the user interface (col 11, lines 23-29). 

Regarding claim 9, Veres et al disclosed a traffic analysis method performed in a 
traffic measurement system (probes or processes monitoring traffic at points A & B 
of Fig 3) that collects packets flowing through Internet links between routers (monitors 
A & B monitoring links between routers, Fig 3, col 8, lines 51-67), analyzes traffic, 
and identifies the applications of the packets (col 9, lines 1-29), the method comprising: 
classifying a first traffic type (TCP) whose applications are identified using only port 
numbers included in flow data that is processed into a predetermined type (col 6, lines 
21-26); classifying a second traffic type (IP) whose applications are identified by 
collecting application headers and application identifiers in the packets, from the flow 
data remaining after the first traffic type is classified (col 9, lines 30-41); classifying a 
third traffic type (UDP) whose applications are identified by analyzing the flow data 
remaining after the second traffic type is classified (col 9, lines 1-4) and reverse- 
direction flow data (both directions of traffic stream) of the flow that are measured at 
different points as a whole (col 10, lines 50-57); classifying a fourth traffic type (RTP) 
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whose applications are identified by analyzing the flow data remaining after the third 
traffic type is classified and flow data measured at different points, since port numbers 
for the applications are not predetermined (col 10, lines 62-67, col 11, lines 1-2); and 
classifying a fifth traffic type (VoIP, item 140 of Fig 4) whose applications cannot be 
identified using the flow data remaining after the fourth traffic type is classified (col 9, 
lines 60-67), but fails to disclose analyzing the traffic data includes analyzing payload 
data included in the traffic data and the traffic types including a traffic type that is 
identified based on an application signature from other flows since the port numbers are 
exchanged through other control flows. However, Riddle et disclosed a method for 
examining the data contained in a traffic flow for classifying the packets based on an 
application signature of the packet flow exchanged over several application ports 
(examine the packet header to classify the traffic distinguished by a signature in 
the packet flow exchanged over known and dynamic ports, col 12, lines 45-67, col 
13, lines 1-67, Figs 3,4A/B). Therefore it would have been obvious for one of ordinary 
skill in the art at the time the invention was made to use the method of examining the 
data contained in a traffic flow for classifying the packets based on an application 
signature of the packet flow exchanged over application ports as taught by Riddle et al 
in the system of Veres et al to analyze every part of the traffic data packet to accurately 
classify the packets in to predetermined application type that are exchanged through the 
flows. One is motivated as such in order to accurately classify the packets by analyzing 
the payload data included in the traffic data to minimize the drop rate of the packets to 
enhance the quality of service. 



Application/Control Number: 10/693,416 Page 8 

Art Unit: 2619 

Regarding claim 10, Veres et al disclosed the flow data is packets having the 
same target address (destination port), the same protocol (FTP), and the same port 
number among the packets flowing through the Internet lines (col 11, lines 34-45). 

Regarding claim 1 1 , Veres et al disclosed determining whether identification data 
of the fourth traffic type (RTP) is present in traffic included classified into the first traffic 
type (TCP) and extracting and storing the application signature of the fourth traffic type, 
after classifying the first traffic type (col 9, lines 30-37, Fig 4). 

Regarding claims 12-13, Veres et al disclosed extracting and storing the 
application signature of traffic classified into the third traffic type (UDP) when traffic 
classified into the second traffic type (IP) is backward traffic of traffic classified into the 
third traffic type, after classifying the second traffic type (col 10, lines 50-67) and 
determining whether identification data of the fourth traffic type (RTP) is present in traffic 
classified into the second traffic type and extracting and storing the application signature 
(service dependent applications, RTP, FTP, WWW etc.,) of the fourth traffic type, 
after classifying the second traffic type (col 11, lines 1-12, Fig 4). 

Regarding claim 15, Veres et al disclosed processing the classified traffic types 
into predetermined report types desired by a user and storing or providing the 
processed report through a user interface, after classifying the fifth traffic type (col 15, 
lines 57-63, Fig 8c). 
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Response to Arguments 

3. Applicant's argument, see remarks filed on 02/13/2008 with respect to rejection 
of claims 1-16 have been fully considered and is persuasive. 

With respect to applicant's argument for claims 1 , 9 that Veres and Kloth 
references fail to teach or suggest the limitations of "the traffic types including a traffic 
type that is identified based on an application signature from other flows since the port 
numbers are exchanged through other control flows" the examiner agrees and therefore 
a new search was performed. However a new ground(s) of rejection has been made 
using Veres and a newly found Riddle et al reference as in this office action. 

Allowable Subject Matter 

5. Claims 8, 14 are objected to as being dependent upon a rejected base claim, but 
would be allowable if rewritten in independent form including all of the limitations of the 
base claim and any intervening claims. 

Conclusion 

6. Any inquiry concerning this communication or earlier communications should be 
directed to the attention to Venkatesh Haliyur whose phone number is 571-272-8616. 
The examiner can normally be reached on Monday-Friday from 9:00AM to 5:00 PM. If 
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attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Edan Orgad can be reached @ (571)-272-7884. Any inquiry of a general 
nature or relating to the status of this application or proceeding should be directed to the 
group receptionist whose telephone number is (571 )-272-2600 or fax to 571 -273-8300. 

7. Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for published 
applications may be obtained from either Private PAIR or Public PAIR. Status 
information for unpublished applications is available through Private PAIR only. For 
more information about the PAIR system, see http://pair-direct.LiSPto.gov . Should you 
have questions on access to the Private PAIR system, contact the Electronic Business 
Center (EBC) at 866-21 7-91 97(toll-free). 

A/enkatesh Haliyur/ 
Examiner, Art Unit 2619 

/Edan Orgad/ 

Supervisory Patent Examiner, Art Unit 2619 



